An executable file (e.g., a binary image, object code, portable executables (PEs), macros, scripts like Visual Basic script (VBS), etc.) can be risky to run on a computer as it may contain a virus or a Trojan horse. A virus is a program or piece of code that modifies a binary image on disk, typically against the user's wishes and without the user's knowledge. Viruses can also replicate themselves. A simple virus that can make a copy of itself over and over again is relatively easy to produce. Even simple viruses are dangerous because they may quickly use all available memory and bring a system to a halt. Some viruses are capable of transmitting themselves across networks and bypassing security systems. Unlike viruses, Trojan horses do not replicate themselves but they can be just as destructive, often masquerading as benign applications that can be launched by an unsuspecting user. One type of Trojan horse is a program that claims to rid your computer of viruses but instead introduces viruses onto your computer.
One approach to identify executable code that has been corrupted, for example, with a virus or a Trojan horse, involves the use of trusted cryptographic hashes when installing or downloading an executable onto a computing device. A cryptographic hash, or simply a “hash”, compiles an executable into a summarized form, or digest. A trusted hash is known to be good, or represent uncorrupted code, at the time of the hashes' creation (e.g., at build time). To generate trusted hashes for an executable file (i.e., a binary image, executable code, scripts, macros, etc.), a message digest or checksum calculation is performed on the executable, including associated resources such as data, to obtain a first trusted result (e.g., at build time) before transferring the executable from one location to another. The same calculation is made on the transferred executable to obtain a second result. The first trusted result is compared to the second result to determine if the received executable is the same data that was originally sent. For instance, if the before and after calculation results match, then the received data is likely accurate. Otherwise, the received executable has been corrupted. In this manner, the risk of downloading or installing a corrupted binary image has been effectively reduced.
Although conventional techniques to verify files at installation reduce the risk of installing files associated with trusted hashes, these conventional techniques do not reduce the risk of installing files from untrusted sources (e.g., without a trusted hash or signature of the file), executing files after they have been installed onto a computing device, or executing files that are part of the basic input output system (BIOS). Problems associated with installing a file from an untrusted source onto a computing system are well known. To make matters worse, files verified for integrity at installation-time can be corrupted after installation, making any initial trust verification evaluations obsolete. Additionally, today's computer systems have no inherent mechanism to distinguish between trusted and suspect or malicious executable object codes. In the case of a file loaded into BIOS firmware, when the file is loaded for execution during boot-up operations, conventional systems typically do not have enough code integrity checking infrastructure in place (loaded) at that time to adequately perform code integrity or any other type of virus, spy ware, or other malicious software (malware) check on the file prior to its execution as part of the boot-up process.